dsh-asc

App Store Connect CLI (asc) as a native tool for DeepSeek Harness (DSH).

dsh-asc registers a single agent tool, asc, that wraps the open-source App Store Connect CLI (rorkai/App-Store-Connect-CLI) binary — 76 top-level command groups backed by 1,200+ App Store Connect API endpoints: TestFlight, build uploads, App Store releases, Apple Ads, code signing, screenshots, metadata & keywords, subscriptions, analytics, Xcode Cloud, marketplace resources, and alternative distribution.

The tool takes structured arguments (an argv token array) and returns asc's JSON output losslessly. No shell is involved, so a model-supplied argument list can never be interpreted as shell commands.

Features

• Structured invocation — pass ["apps","list"] instead of a free-form string.
• JSON out by default — asc auto-detects non-interactive mode and emits JSON; you get { ok, exitCode, stdout, stderr }.
• Shell-injection safe — runs via execFile('asc', argv) with no shell.
• Built-in safety rails — destructive operations still require asc's explicit --confirm.
• Shared auth — reuses asc auth login, ~/.asc/config.json, or ASC_* env vars from the host environment.

Requirements

• asc installed locally: curl -fsSL https://asccli.sh/install | bash or brew install asc
• Authenticated: asc auth login (or set ASC_KEY_ID / ASC_ISSUER_ID / ASC_PRIVATE_KEY / ASC_PRIVATE_KEY_B64)

Install

# local checkout
dsh plugin --profile web add ./dsh-asc

# from GitHub
dsh plugin --profile web add github:Tangweiwei227/dsh-asc

Then restart dsh web (or your profile). New sessions get the asc tool.

Usage

Just ask your agent in natural language — it will call the asc tool:

• "List the apps on my account"
• "Upload this build to TestFlight"
• "Pull localized metadata for this app"
• "Check my current asc auth status"

Under the hood the agent calls:

asc: ["apps", "list"]
asc: ["builds", "upload", "--app", "123", "--ipa", "build.ipa"]
asc: ["metadata", "pull", "--app", "123"]
asc: ["auth", "status"]

How it works

• The plugin is a plain Cordis plugin: inject = ['tools'] waits for the tools service, then ctx.tools.register(defineTool({...})) publishes the asc tool into the global registry.
• execFile('asc', argv) runs the binary with no shell, so arguments are never interpreted as a command line.
• asc emits JSON when stdout is not a TTY; results pass through verbatim.
• Tool timeout is 300 s to leave room for long-running upload/wait workflows; stdout buffer is capped at 64 MB.

Development

pnpm install
pnpm build    # src/ → lib/
pnpm check    # type-check + build

License

MIT — see LICENSE. The asc CLI itself is MIT-licensed by its authors.